toolroll 0.9.70 → 0.9.72

package/dist/commit-extract.js

@@ -0,0 +1,436 @@
+/**
+ * The approved commit's files, written by Toolroll itself from a repository's object store (docs/plans/approval-policy.md
+ * §1.7): the release runs the deployment script from what this writes, never from the candidate's checkout.
+ *
+ * No conversion of any kind: `git cat-file --batch` hands back each object's stored bytes, and this code hashes the
+ * commit, every tree and every blob itself against the ids that name them and parses the trees itself, so no filter, smudge, textconv, export-subst, export-ignore or other attribute (from the repository's
+ * config, `info/attributes` or the tree's own `.gitattributes`) can change or add a byte. Before any read the
+ * repository's own config is refused if it names a command or includes another file (teardown-git.ts), and git runs
+ * with no system or global config, no replacement objects, no lazy fetch, no hooks and no fsmonitor. Only regular
+ * files are written (mode 644, or 755 when the tree says executable), each at a normalized path inside the folder;
+ * symlinks, submodules and any other entry refuse the whole extraction.
+ */
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, realpathSync, writeFileSync } from "node:fs";
+import { join, sep } from "node:path";
+import { checkoutGitEnv, HARDENED_GIT_ARGS } from "./agent-fence.js";
+import { commandSetting } from "./teardown-git.js";
+const MAX_BYTES = 1024 * 1024 * 1024;
+export const EXTRACTION_LIMITS = Object.freeze({ bytes: MAX_BYTES, files: 50_000, entries: 200_000, depth: 64 });
+/** A tree path that stays where it says: relative, no empty, `.` or `..` part, no backslash or control character. */
+export function normalizedTreePath(path) {
+    if (path === "" || path.startsWith("/") || /[\u0000-\u001f\\]/.test(path))
+        return false;
+    return path.split("/").every(part => part !== "" && part !== "." && part !== "..");
+}
+/** The object id Git gives `<type> <size>\0<bytes>` in this repository's object format. */
+export const objectIdOf = (format, type, bytes) => createHash(format).update(`${type} ${bytes.length}\0`).update(bytes).digest("hex");
+/** A tree object's entries, parsed from its verified bytes: `<mode> <name>\0<raw id>` each. Null when malformed. */
+export function parseTree(bytes, idBytes) {
+    const entries = [];
+    let at = 0;
+    while (at < bytes.length) {
+        const space = bytes.indexOf(0x20, at), nul = space < 0 ? -1 : bytes.indexOf(0x00, space);
+        if (space < 0 || nul < 0 || nul + 1 + idBytes > bytes.length)
+            return null;
+        entries.push({ mode: bytes.subarray(at, space).toString("latin1"), name: bytes.subarray(space + 1, nul).toString("utf8"), id: bytes.subarray(nul + 1, nul + 1 + idBytes).toString("hex") });
+        at = nul + 1 + idBytes;
+    }
+    return entries;
+}
+/** Write commit `sha` of the repository whose Git directory is `gitDir` (a realpath Toolroll took from its own
+ * records) into `dest`, an empty folder this process made. Every object on the way — the commit, each tree, each
+ * blob — is hashed here and must be the id that names it: Git's own answer about an id is never taken on trust, so a
+ * corrupted or replaced object in a store a build could write to refuses the extraction. */
+export function extractCommit(gitDir, sha, dest, limits = EXTRACTION_LIMITS) {
+    const refuse = (message) => ({ ok: false, message });
+    const env = { ...checkoutGitEnv(), GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", GIT_NO_REPLACE_OBJECTS: "1", GIT_NO_LAZY_FETCH: "1", GIT_ATTR_NOSYSTEM: "1" };
+    const git = (args, input) => spawnSync("git", ["--git-dir", gitDir, "--no-replace-objects", ...HARDENED_GIT_ARGS, ...args], { env, input, maxBuffer: MAX_BYTES, timeout: 300_000 });
+    // The repository's own config, read without includes, must name no command and include nothing.
+    const config = git(["config", "--list", "--no-includes", "--show-scope", "-z"]);
+    if (config.status !== 0)
+        return refuse("The project's Git config couldn't be read.");
+    const listing = config.stdout.toString("utf8");
+    const command = commandSetting(listing);
+    if (command !== null)
+        return refuse(`The project's Git config sets ${command}, which can run a command.`);
+    const format = /(?:^|\0)local\0extensions\.objectformat\nsha256(?:\0|$)/i.test(listing) ? "sha256" : "sha1";
+    const hexLength = format === "sha1" ? 40 : 64;
+    if (!new RegExp(`^[0-9a-f]{${hexLength}}$`).test(sha))
+        return refuse(`${sha} isn't a full commit id.`);
+    /** Objects by id, each read raw (`cat-file --batch`: "<id> <type> <size>\n<bytes>\n") and hashed here. */
+    const read = (ids) => {
+        const batch = git(["cat-file", "--batch"], Buffer.from(ids.map(id => `${id}\n`).join(""), "utf8"));
+        if (batch.status !== 0)
+            return "the objects couldn't be read";
+        const out = batch.stdout, found = new Map();
+        let at = 0;
+        for (const id of ids) {
+            const newline = out.indexOf(0x0a, at);
+            if (newline < 0)
+                return "the objects couldn't be read";
+            const header = out.subarray(at, newline).toString("utf8").split(" ");
+            if (header.length !== 3 || header[0] !== id || !/^\d+$/.test(header[2]))
+                return `object ${id.slice(0, 12)} is missing or unreadable`;
+            const start = newline + 1, end = start + Number(header[2]);
+            if (end + 1 > out.length || out[end] !== 0x0a)
+                return `object ${id.slice(0, 12)} couldn't be read whole`;
+            const bytes = out.subarray(start, end);
+            if (objectIdOf(format, header[1], bytes) !== id)
+                return `object ${id.slice(0, 12)} doesn't hash to its id`;
+            found.set(id, { type: header[1], bytes });
+            at = end + 1;
+        }
+        return found;
+    };
+    const commit = read([sha]);
+    if (typeof commit === "string")
+        return refuse(`The approved commit couldn't be verified: ${commit}.`);
+    const commitObject = commit.get(sha);
+    if (commitObject.type !== "commit")
+        return refuse(`${sha.slice(0, 7)} isn't a commit.`);
+    const treeLine = new RegExp(`^tree ([0-9a-f]{${hexLength}})\n`).exec(commitObject.bytes.toString("utf8"));
+    if (treeLine === null)
+        return refuse("The approved commit names no tree.");
+    // Walk the trees from their verified bytes, level by level; collect every file.
+    const files = [];
+    let level = [{ id: treeLine[1], prefix: "" }];
+    let depth = 0, walked = 0;
+    while (level.length > 0) {
+        if (++depth > limits.depth)
+            return refuse(`The commit's folders nest deeper than ${limits.depth}.`);
+        const trees = read(level.map(one => one.id));
+        if (typeof trees === "string")
+            return refuse(`The approved commit couldn't be verified: ${trees}.`);
+        const next = [];
+        for (const { id, prefix } of level) {
+            const tree = trees.get(id);
+            if (tree.type !== "tree")
+                return refuse(`The approved commit's tree ${id.slice(0, 12)} isn't a tree.`);
+            const entries = parseTree(tree.bytes, hexLength / 2);
+            if (entries === null)
+                return refuse(`The approved commit's tree ${id.slice(0, 12)} couldn't be read.`);
+            walked += entries.length;
+            if (walked > limits.entries)
+                return refuse(`The commit's trees hold more than ${limits.entries} entries.`);
+            for (const entry of entries) {
+                const path = prefix === "" ? entry.name : `${prefix}/${entry.name}`;
+                if (entry.name.includes("/") || !normalizedTreePath(path))
+                    return refuse(`The commit holds a path that isn't normalized (${JSON.stringify(path)}).`);
+                if (entry.mode === "40000")
+                    next.push({ id: entry.id, prefix: path });
+                else if (entry.mode === "120000")
+                    return refuse(`The commit holds a symlink (${path}); a deployment never runs one.`);
+                else if (entry.mode === "160000")
+                    return refuse(`The commit holds a submodule (${path}); a deployment never runs one.`);
+                else if (entry.mode === "100644" || entry.mode === "100755") {
+                    files.push({ mode: entry.mode, id: entry.id, path });
+                    if (files.length > limits.files)
+                        return refuse(`The commit holds more than ${limits.files} files.`);
+                }
+                else
+                    return refuse(`The commit holds an entry that isn't a plain file (${path}).`);
+            }
+        }
+        level = next;
+    }
+    if (files.length === 0)
+        return refuse(`The commit ${sha.slice(0, 7)} holds no files.`);
+    const blobs = read([...new Set(files.map(one => one.id))]);
+    if (typeof blobs === "string")
+        return refuse(`The approved commit couldn't be verified: ${blobs}.`);
+    // What would be written, every path counted (a blob shared by many paths is written once per path).
+    let total = 0;
+    for (const file of files) {
+        total += blobs.get(file.id).bytes.length;
+        if (total > limits.bytes)
+            return refuse(`The commit's files come to more than ${limits.bytes} bytes.`);
+    }
+    const root = realpathSync(dest);
+    for (const file of files) {
+        const blob = blobs.get(file.id);
+        if (blob.type !== "blob")
+            return refuse(`${file.path} isn't a file in the commit.`);
+        const target = join(root, ...file.path.split("/"));
+        if (!target.startsWith(root + sep))
+            return refuse(`The path ${file.path} leaves the folder.`);
+        try {
+            mkdirSync(join(target, ".."), { recursive: true, mode: 0o755 });
+            // "wx": never over anything already there (no file twice, no file where a folder is).
+            writeFileSync(target, blob.bytes, { flag: "wx", mode: file.mode === "100755" ? 0o755 : 0o644 });
+        }
+        catch (error) {
+            return refuse(`The file ${file.path} couldn't be written: ${error.message}`);
+        }
+    }
+    return { ok: true, files: files.length };
+}
+/** A reader over the project's object store that hashes every object it hands back, or why it can't be one. */
+function verifiedReader(gitDir) {
+    const refuse = (message) => ({ ok: false, message });
+    const env = { ...checkoutGitEnv(), GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", GIT_NO_REPLACE_OBJECTS: "1", GIT_NO_LAZY_FETCH: "1", GIT_ATTR_NOSYSTEM: "1" };
+    const git = (args, input) => spawnSync("git", ["--git-dir", gitDir, "--no-replace-objects", ...HARDENED_GIT_ARGS, ...args], { env, input, maxBuffer: MAX_BYTES, timeout: 300_000 });
+    // History a build could have rewritten around the objects: a shallow boundary, grafts, or replacement refs. Each is
+    // refused outright, so no reader here ever has to decide whether to believe one.
+    if (existsSync(join(gitDir, "shallow")))
+        return refuse("The project's history is shallow, so the commits between the approval and this one can't all be read.");
+    if (existsSync(join(gitDir, "info", "grafts")))
+        return refuse("The project's Git directory has grafts, which rewrite history; they are refused.");
+    const replaced = git(["for-each-ref", "--format=%(refname)", "refs/replace/"]);
+    if (replaced.status !== 0)
+        return refuse("The project's refs couldn't be read.");
+    if (replaced.stdout.toString("utf8").trim() !== "")
+        return refuse("The project's Git directory has replacement refs, which swap objects; they are refused.");
+    const config = git(["config", "--list", "--no-includes", "--show-scope", "-z"]);
+    if (config.status !== 0)
+        return refuse("The project's Git config couldn't be read.");
+    const listing = config.stdout.toString("utf8");
+    const command = commandSetting(listing);
+    if (command !== null)
+        return refuse(`The project's Git config sets ${command}, which can run a command.`);
+    const format = /(?:^|\0)local\0extensions\.objectformat\nsha256(?:\0|$)/i.test(listing) ? "sha256" : "sha1";
+    const hexLength = format === "sha1" ? 40 : 64;
+    const read = (ids) => {
+        const found = new Map();
+        const wanted = [...new Set(ids)];
+        if (wanted.length === 0)
+            return found;
+        if (wanted.some(id => !new RegExp(`^[0-9a-f]{${hexLength}}$`).test(id)))
+            return "an object id isn't a full id";
+        const batch = git(["cat-file", "--batch"], Buffer.from(wanted.map(id => `${id}\n`).join(""), "utf8"));
+        if (batch.status !== 0)
+            return "the objects couldn't be read";
+        const out = batch.stdout;
+        let at = 0;
+        for (const id of wanted) {
+            const newline = out.indexOf(0x0a, at);
+            if (newline < 0)
+                return "the objects couldn't be read";
+            const header = out.subarray(at, newline).toString("utf8").split(" ");
+            if (header.length !== 3 || header[0] !== id || !/^\d+$/.test(header[2]))
+                return `object ${id.slice(0, 12)} is missing or unreadable`;
+            const start = newline + 1, end = start + Number(header[2]);
+            if (end + 1 > out.length || out[end] !== 0x0a)
+                return `object ${id.slice(0, 12)} couldn't be read whole`;
+            const bytes = out.subarray(start, end);
+            if (objectIdOf(format, header[1], bytes) !== id)
+                return `object ${id.slice(0, 12)} doesn't hash to its id`;
+            found.set(id, { type: header[1], bytes });
+            at = end + 1;
+        }
+        return found;
+    };
+    return { ok: true, value: { format, hexLength, read } };
+}
+/** Parse a commit from its verified bytes: tree, parents, message. Null when malformed. */
+function parseCommit(id, bytes, hexLength) {
+    const text = bytes.toString("utf8");
+    const split = text.indexOf("\n\n");
+    const head = split < 0 ? text : text.slice(0, split);
+    const lines = head.split("\n");
+    const tree = new RegExp(`^tree ([0-9a-f]{${hexLength}})$`).exec(lines[0] ?? "");
+    if (tree === null)
+        return null;
+    const parents = [];
+    for (const line of lines.slice(1)) {
+        const parent = new RegExp(`^parent ([0-9a-f]{${hexLength}})$`).exec(line);
+        if (parent === null)
+            break;
+        parents.push(parent[1]);
+    }
+    return { id, tree: tree[1], parents, message: split < 0 ? "" : text.slice(split + 2) };
+}
+/** One commit, hashed here and parsed from its own bytes. */
+export function readVerifiedCommit(gitDir, sha) {
+    const reader = verifiedReader(gitDir);
+    if (!reader.ok)
+        return reader;
+    return readCommitWith(reader.value, sha);
+}
+function readCommitWith(reader, sha) {
+    const got = reader.read([sha]);
+    if (typeof got === "string")
+        return { ok: false, message: `Commit ${sha.slice(0, 7)} couldn't be verified: ${got}.` };
+    const object = got.get(sha);
+    if (object.type !== "commit")
+        return { ok: false, message: `${sha.slice(0, 7)} isn't a commit.` };
+    const commit = parseCommit(sha, object.bytes, reader.hexLength);
+    return commit === null ? { ok: false, message: `Commit ${sha.slice(0, 7)} couldn't be read.` } : { ok: true, value: commit };
+}
+/**
+ * The commits from `from` back to `until` along first parents, newest first, `until` itself left out. Refuses when
+ * `until` isn't reached within `max` commits (it isn't an ancestor, or too much lies between), and hands back each
+ * commit's full parent list so a caller can refuse merges.
+ */
+export function verifiedFirstParentWalk(gitDir, from, until, max = 200) {
+    const reader = verifiedReader(gitDir);
+    if (!reader.ok)
+        return reader;
+    const commits = [];
+    let at = from;
+    while (at !== until) {
+        if (commits.length >= max)
+            return { ok: false, message: `${until.slice(0, 7)} isn't within ${max} commits before ${from.slice(0, 7)}.` };
+        const commit = readCommitWith(reader.value, at);
+        if (!commit.ok)
+            return commit;
+        commits.push(commit.value);
+        const parent = commit.value.parents[0];
+        if (parent === undefined)
+            return { ok: false, message: `${until.slice(0, 7)} isn't an ancestor of ${from.slice(0, 7)}.` };
+        at = parent;
+    }
+    return { ok: true, value: commits };
+}
+/** Every entry of a verified tree at its full path, symlinks and submodules included (a caller decides on them). An
+ * unnormalized path, or one a tree lists twice, refuses the whole read. */
+export function verifiedTreeEntries(gitDir, tree, limits = EXTRACTION_LIMITS) {
+    const reader = verifiedReader(gitDir);
+    if (!reader.ok)
+        return reader;
+    return treeEntriesWith(reader.value, tree, limits);
+}
+function treeEntriesWith(reader, root, limits) {
+    const refuse = (message) => ({ ok: false, message });
+    const entries = [];
+    let level = [{ id: root, prefix: "" }];
+    let depth = 0, walked = 0;
+    const seen = new Set();
+    while (level.length > 0) {
+        if (++depth > limits.depth)
+            return refuse(`The commit's folders nest deeper than ${limits.depth}.`);
+        const trees = reader.read(level.map(one => one.id));
+        if (typeof trees === "string")
+            return refuse(`A tree couldn't be verified: ${trees}.`);
+        const next = [];
+        for (const { id, prefix } of level) {
+            const tree = trees.get(id);
+            if (tree.type !== "tree")
+                return refuse(`${id.slice(0, 12)} isn't a tree.`);
+            const parsed = parseTree(tree.bytes, reader.hexLength / 2);
+            if (parsed === null)
+                return refuse(`Tree ${id.slice(0, 12)} couldn't be read.`);
+            walked += parsed.length;
+            if (walked > limits.entries)
+                return refuse(`The trees hold more than ${limits.entries} entries.`);
+            for (const entry of parsed) {
+                const path = prefix === "" ? entry.name : `${prefix}/${entry.name}`;
+                if (entry.name.includes("/") || !normalizedTreePath(path))
+                    return refuse(`A tree holds a path that isn't normalized (${JSON.stringify(path)}).`);
+                if (seen.has(path))
+                    return refuse(`A tree lists ${path} twice.`);
+                seen.add(path);
+                if (entry.mode === "40000")
+                    next.push({ id: entry.id, prefix: path });
+                else if (["100644", "100755", "120000", "160000"].includes(entry.mode))
+                    entries.push({ path, mode: entry.mode, id: entry.id });
+                else
+                    return refuse(`A tree holds an entry of an unknown kind (${path}).`);
+                if (entries.length > limits.files)
+                    return refuse(`The tree holds more than ${limits.files} entries.`);
+            }
+        }
+        level = next;
+    }
+    return { ok: true, value: entries.sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0)) };
+}
+/** Whether bytes look binary: a NUL in the first 8000 bytes, as Git judges. */
+export const looksBinary = (bytes) => bytes.subarray(0, 8000).includes(0);
+/** The lines added and deleted from `before` to `after`, by the shortest edit (Myers): each counted once, stopped at
+ * `cap` total edits (the counts then add up to more than `cap`, which every limit here refuses). */
+export function lineChanges(before, after, cap = 100_000) {
+    const split = (bytes) => { const text = bytes.toString("utf8"); if (text === "")
+        return []; const lines = text.split("\n"); if (lines[lines.length - 1] === "")
+        lines.pop(); return lines; };
+    const a = split(before), b = split(after);
+    // Trim the common start and end first: most changes are small.
+    let start = 0;
+    while (start < a.length && start < b.length && a[start] === b[start])
+        start++;
+    let endA = a.length, endB = b.length;
+    while (endA > start && endB > start && a[endA - 1] === b[endB - 1]) {
+        endA--;
+        endB--;
+    }
+    const n = endA - start, m = endB - start;
+    if (n === 0 || m === 0)
+        return { added: m, deleted: n };
+    const max = Math.min(n + m, cap);
+    const v = new Int32Array(2 * max + 2);
+    const off = max + 1;
+    for (let d = 0; d <= max; d++) {
+        for (let k = -d; k <= d; k += 2) {
+            let x = k === -d || (k !== d && v[off + k - 1] < v[off + k + 1]) ? v[off + k + 1] : v[off + k - 1] + 1;
+            let y = x - k;
+            while (x < n && y < m && a[start + x] === b[start + y]) {
+                x++;
+                y++;
+            }
+            v[off + k] = x;
+            if (x >= n && y >= m) {
+                const common = (n + m - d) / 2;
+                return { added: m - common, deleted: n - common };
+            }
+        }
+    }
+    // Past the cap: report everything as changed, which is more than any limit allows.
+    return { added: m, deleted: n };
+}
+/**
+ * What differs between two verified trees, path by path (no rename pairing: a moved file is a deletion and an
+ * addition). Text files get their added and deleted lines; a binary side, a symlink or a submodule is marked so a caller
+ * can refuse it.
+ */
+export function verifiedTreeDiff(gitDir, beforeTree, afterTree) {
+    const reader = verifiedReader(gitDir);
+    if (!reader.ok)
+        return reader;
+    const before = treeEntriesWith(reader.value, beforeTree, EXTRACTION_LIMITS);
+    if (!before.ok)
+        return before;
+    const after = treeEntriesWith(reader.value, afterTree, EXTRACTION_LIMITS);
+    if (!after.ok)
+        return after;
+    const was = new Map(before.value.map(one => [one.path, one]));
+    const now = new Map(after.value.map(one => [one.path, one]));
+    const paths = [...new Set([...was.keys(), ...now.keys()])].sort();
+    const differing = paths.filter(path => { const a = was.get(path), b = now.get(path); return a === undefined || b === undefined || a.id !== b.id || a.mode !== b.mode; });
+    const blobIds = differing.flatMap(path => [was.get(path), now.get(path)]).filter((one) => one !== undefined && (one.mode === "100644" || one.mode === "100755")).map(one => one.id);
+    const blobs = reader.value.read(blobIds);
+    if (typeof blobs === "string")
+        return { ok: false, message: `A changed file couldn't be verified: ${blobs}.` };
+    const changes = [];
+    for (const path of differing) {
+        const a = was.get(path) ?? null, b = now.get(path) ?? null;
+        const bytesOf = (entry) => {
+            if (entry === null || (entry.mode !== "100644" && entry.mode !== "100755"))
+                return null;
+            const blob = blobs.get(entry.id);
+            return blob !== undefined && blob.type === "blob" ? blob.bytes : null;
+        };
+        const fileLike = (entry) => entry === null || entry.mode === "100644" || entry.mode === "100755";
+        const ab = bytesOf(a), bb = bytesOf(b);
+        if ((a !== null && fileLike(a) && ab === null) || (b !== null && fileLike(b) && bb === null))
+            return { ok: false, message: `${path} isn't a file in its commit.` };
+        const binary = !fileLike(a) || !fileLike(b) || (ab !== null && looksBinary(ab)) || (bb !== null && looksBinary(bb));
+        const counted = binary ? { added: 0, deleted: 0 } : lineChanges(ab ?? Buffer.alloc(0), bb ?? Buffer.alloc(0));
+        changes.push({ path, kind: a === null ? "added" : b === null ? "deleted" : "modified", before: a, after: b, ...counted, binary });
+    }
+    return { ok: true, value: changes };
+}
+/** The ids of verified blobs at these paths of a tree (absent paths left out): a digest's inputs, read without
+ * running anything. */
+export function verifiedBlobs(gitDir, tree, paths) {
+    const reader = verifiedReader(gitDir);
+    if (!reader.ok)
+        return reader;
+    const entries = treeEntriesWith(reader.value, tree, EXTRACTION_LIMITS);
+    if (!entries.ok)
+        return entries;
+    const wanted = entries.value.filter(one => paths.includes(one.path) && (one.mode === "100644" || one.mode === "100755"));
+    const blobs = reader.value.read(wanted.map(one => one.id));
+    if (typeof blobs === "string")
+        return { ok: false, message: `A file couldn't be verified: ${blobs}.` };
+    return { ok: true, value: new Map(wanted.map(one => [one.path, { id: one.id, bytes: blobs.get(one.id).bytes }])) };
+}

package/dist/contracts/console-api.d.ts

@@ -190,7 +190,7 @@ export declare const CONSOLE_FORMS: {
 };
 export type ConsoleFormName = keyof typeof CONSOLE_FORMS;
 /** The console POSTs whose handlers read no field (sign-out not even the shared guard): their contract is the empty form. */
-export declare const BODILESS_POSTS: readonly ["POST /settings/models/<unknown action>", "POST /settings/lead/on", "POST /r/<run>/draft-repair", "POST /ledger/checkpoint", "POST /settings/backups/now", "POST /mode/revoke", "POST /settings/telegram/retry", "POST /providers/<provider>/resume", "POST /logout", "POST /t/<task>/unhold", "POST /t/<task>/plan", "POST /t/<task>/retry-review"];
+export declare const BODILESS_POSTS: readonly ["POST /settings/models/<unknown action>", "POST /settings/lead/on", "POST /r/<run>/draft-repair", "POST /ledger/checkpoint", "POST /settings/backups/now", "POST /mode/revoke", "POST /settings/telegram/retry", "POST /providers/<provider>/resume", "POST /logout", "POST /t/<task>/unhold", "POST /t/<task>/stop-carrying", "POST /t/<task>/plan", "POST /t/<task>/retry-review"];
 /** The field names a console form's handler may read. */
 export type FormFieldOf<N extends ConsoleFormName> = (typeof CONSOLE_FORMS)[N] extends FormContract<infer K> ? K : never;
 /** `GET /ledger?format=json`: the chain's state, a page of entries (newest first) and the cursor for the next. */

package/dist/contracts/console-api.js

@@ -213,6 +213,7 @@ export const BODILESS_POSTS = [
     "POST /providers/<provider>/resume",
     "POST /logout",
     "POST /t/<task>/unhold",
+    "POST /t/<task>/stop-carrying",
     "POST /t/<task>/plan",
     "POST /t/<task>/retry-review",
 ];

package/dist/contracts/flow.d.ts

@@ -11023,6 +11023,14 @@ export declare const standingOrderSchema: z.ZodObject<{
         profileJson: z.ZodString;
         routeJson: z.ZodString;
     }, z.core.$strict>>;
+    check: z.ZodOptional<z.ZodObject<{
+        kind: z.ZodLiteral<"main-full">;
+        grant: z.ZodObject<{
+            id: z.ZodInt;
+            digest: z.ZodString;
+        }, z.core.$strict>;
+        access: z.ZodLiteral<"sandboxed">;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 export type StandingOrder = z.infer<typeof standingOrderSchema>;
 /** A trigger as it is saved (`configJson`), one schema per kind. */
@@ -11058,6 +11066,14 @@ export declare const triggerConfigSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             profileJson: z.ZodString;
             routeJson: z.ZodString;
         }, z.core.$strict>>;
+        check: z.ZodOptional<z.ZodObject<{
+            kind: z.ZodLiteral<"main-full">;
+            grant: z.ZodObject<{
+                id: z.ZodInt;
+                digest: z.ZodString;
+            }, z.core.$strict>;
+            access: z.ZodLiteral<"sandboxed">;
+        }, z.core.$strict>>;
     }, z.core.$strict>>;
 }, z.core.$strict>, z.ZodObject<{
     zone: z.ZodNullable<z.ZodString>;

package/dist/contracts/flow.js

@@ -354,6 +354,9 @@ export const standingOrderSchema = z.strictObject({
     /** The routine it came from: that routine's earlier tasks still count toward one-at-a-time and the ceiling. */
     routine: z.int().nullable(),
     approval: z.strictObject({ digest: z.string().min(1), by: z.string().nullable(), at: z.string().min(1), profileJson: z.string().min(1), routeJson: z.string().min(1) }).nullable(),
+    /** The nightly full check on main (release-once.md, part 3): each firing files a check-only task at main's head, its
+     * approval bound to the release check grant and the fenced check access. */
+    check: z.strictObject({ kind: z.literal("main-full"), grant: z.strictObject({ id: z.int(), digest: z.string().min(1) }), access: z.literal("sandboxed") }).optional(),
 });
 /** A trigger as it is saved (`configJson`), one schema per kind. */
 export const triggerConfigSchema = z.discriminatedUnion("kind", [